The Linux kernel function tap_get_user_xdp() allocates a page fragment for every inbound XDP packet. When a frame is shorter than the Ethernet header, tap_get_user_xdp rejects it with -EINVAL; when building the socket buffer fails, it returns -ENOMEM. In both failing pathways the function jumps to an error label that does not free the previously allocated page, resulting in a kernel memory leak of one page fragment per rejected frame. The CWEs reflected in the CVE record are CWE‑401 (Memory Leak) and CWE‑772 (Resource Leak).

Any Linux kernel build prior to the fix commit (18a84c…) that still enables TAP interfaces with XDP support is affected. This includes the 7.x series releases before the patch and any custom kernel that has not been updated. Virtualized environments, container runtimes, and host systems that expose TAP devices are thus within scope.

Based on the description, it is inferred that an attacker can trigger the leak by sending malformed frames to a TAP endpoint; this could be carried out over the network or locally if TAP access is privileged. Repeating the fault conditions drains kernel memory and can cause allocation failures, resulting in a denial of service. The CVSS score of 7.4 reflects high severity, while the EPSS score of less than 1% indicates a very low current exploitation probability. The vulnerability is not included in the CISA KEV list.